Data Protection Information according to Art. 13, 14 GDPR
As the operator of these pages, we take the protection of your personal data very seriously. We therefore treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.
Should offers from other providers be accessible from our website, our data protection information does not apply to them.
With the following data protection information, we would like to inform you about how we handle your personal data in detail. For reasons of better readability, the language form of the generic masculine is used. Please note that the exclusive use of the masculine form should be understood to be gender-independent.
General Information
1. Name and Contact Details of the Person Responsible
The controller within the meaning of data protection laws, in particular the EU General Data Protection Regulation (GDPR), is the:
KTG GmbH
Am Unkelstein 46
47059 Duisburg
Tel: +49 (0) 203 3951 2135
E-Mail: info@ktg-railservice.de
Internet: www.ktg-railservice.de
2. Contact Details of the Data Protection Officer
You can reach our data protection officer by email at datenschutz@dataguard.de
Currently appointed as data protection officer for the client:
DataCo GmbH
Nymphenburger Str. 86,
80636 Munich
Tel: +49 (0) 89 7400 45840
E-Mail: datenschutz@dataguard.de
Rights of Data Subjects
1. Right to Information
If your personal data is processed, you have the right to obtain information from the controller about the personal data stored about you (Art. 15 GDPR).
2. Right to Rectification
You have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning you and the right to have incomplete personal data completed (Art. 16 GDPR).
3. Right to Cancellation
If the legal requirements are met, you can request the immediate erasure of your personal data or restriction of processing (Art. 17 and 18 GDPR).
4. Right to Information
If you have asserted the right to rectification, erasure, or restriction of processing against the controller, the controller is obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing unless this proves impossible or involves a disproportionate effort. You have the right to be informed about these recipients by the controller (right to information, Art. 19 GDPR).
5. Right to Data Portability
If you have consented to the data processing or a contract for data processing exists and the data processing is carried out using automated procedures, you may have a right to data portability (Art. 20 GDPR). In exercising this right, you also have the right to obtain that the personal data concerning you be transferred directly from one controller to another controller insofar as this is technically feasible. The freedoms and rights of other persons must not be affected by this.
6. Right to Object to the Processing
You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions. The controller will no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims (Art. 21 (1) GDPR).
7. Right to Object to Direct Marketing
Where personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing (Art. 21 (2) GDPR). If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.
8. Right to Withdraw Consent
You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal (Art. 7 (3) GDPR).
9. Automated Decisions in Individual Cases Including Profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. In this case, if the legal requirements are met, you have the right to obtain human intervention on the part of the controller, to express your point of view, and to contest the decision (Art. 22 GDPR).
10. Right to Lodge a Complaint
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data relating to you infringes the GDPR (Art. 77 GDPR). The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
Provision of the Website
1. Hosting
The website is hosted on servers of a service provider commissioned by us.
Our service provider is:
domainfactory GmbH
c/o WeWork, Neuturmstrasse 5, 80331 Munich, Germany
The servers automatically collect and store information in so-called server log files, which your browser automatically transmits when you visit the website. The information stored is:
- IP address of the requesting computer
- Date and time of access
- Name and URL of the retrieved file
- Website from which the access is made (referrer URL)
- The browser used and, if applicable, the operating system of your computer, as well as the name of your access provider
This data is not merged with other data sources. This data is collected on the basis of Art. 6 para. 1 lit. f GDPR. The processing of the aforementioned data is necessary for the provision of a website and thus serves to safeguard a legitimate interest of the web operator.
The server of the website is geographically located in Strasbourg (France). Your data is transferred to servers in France.
2. Description and Scope of Data Processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer. The following data is collected:
- Information about the browser type and version used
- The user’s operating system
- The user’s internet service provider
- The IP address of the user
- Date and time of access
- Websites from which the user’s system reaches our website
- Websites that are accessed by the user’s system via our website
This data is stored in the log files of our system. This data is not stored together with other personal data of the user.
3. Purpose of Data Processing
Temporary storage of the IP address by the system is necessary to enable delivery of the website to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session.
Data is stored in log files to ensure the functionality of the website. We also use the data to optimize the website and to ensure the security of our information technology systems. The data is not analyzed for marketing purposes in this context.
4. Legal Basis for Data Processing
The legal basis for the temporary storage of log files is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest lies in the purposes of data processing mentioned under 2.
5. Duration of Storage
The data is deleted as soon as it is no longer required to fulfill the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.
Use of Cookies
1. Description and Scope of Data Processing
Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user’s computer system. When a user accesses a website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again.
We use cookies to make our website more user-friendly. Some elements of our website require that the accessing browser can be identified even after a page change. The following data is stored and transmitted in the cookies:
- Language settings
- Log-in information
- Your cookie settings (consent/refusal)
- Search terms
- Other information necessary for the provision of the website
The user data collected in this way is pseudonymized using technical precautions. The data is not stored together with other personal user data.
We also use cookies on our website that enable us to analyze the surfing behavior of users. The following data is stored and transmitted in the analysis cookies:
- User behavior on our website
- Other information used for marketing purposes
You can find more information on our use of cookies in our privacy policy under the section “Plugins and tools used”.
2. Legal Basis for Data Processing
The legal basis for the processing of personal data using technically unnecessary cookies is § 25 para. 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR. Art. 6 para. 1 lit. a GDPR.
The legal basis for the processing of personal data using technically necessary cookies is § 25 para. 2 TDDDG in conjunction with Art. 6 para. 1 lit. f GDPR. Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the purposes of data processing mentioned under 2.
3. Duration of Storage, Objection, and Removal Options
Cookies are stored on the user’s computer and transmitted by it to our website. As a user, you therefore have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your Internet browser. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all the functions of the website to their full extent.
Plugins and Tools Used
When using some plug-in service providers, personal data may be transferred to servers in third countries outside the EU, such as the USA.
The following service providers marked with an * have joined the Trans-Atlantic Data Privacy Framework (TDPF; data protection agreement between the EU and the USA) so that an appropriate level of data protection is guaranteed for data processing.
Borlabs
We use the Borlabs Cookie provided cookie hint plugin for WordPress.
Borlabs GmbH
Hamburger Str. 11, 22083 Hamburg, Germany
When you visit our online presence, you as a user are asked for your individual consent to the use of cookies.
Information on processing can be found here: Data protection (borlabs.io)
We use several plugins provided by Google.
Google Ireland Limited,
Gordon House, Barrow Street, Dublin 4, Ireland
- Google Analytics
- Google Fonts
- reCaptcha
We use the reCaptcha plugin to identify the user as a human being. It is used, among other things, to protect against spam and misuse of our websites. - Google Maps
We use the Google Maps plugin to offer interested visitors a navigation aid to our locations. - YouTube
We use the YouTube plugin to embed videos from YouTube on our online presence.
When you visit our online presence, your browser establishes a connection with the plugin servers. This allows personal data to be stored and analyzed, in particular, the user’s activity (in particular, which pages have been visited and which elements have been clicked on) as well as device and browser information (in particular, the IP address and operating system). We have no influence on the content of the plug-in. If you are logged into your personal account during your visit, your online presence visit can be assigned to this account. By interacting with this plug-in, this corresponding information is transmitted directly to the plug-in owner and stored there.
Information on the processing of data by Google can be found here: https://policies.google.com/privacy?gl=DE&hl=de
Purpose of the processing:
The use of plug-ins serves to improve user-friendliness and an appealing presentation of our online presence, as well as the protection and technical functionality of the online presence.
Legal basis for the processing of personal data:
The legal basis for the processing of users’ personal data is generally the consent of the user in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.
Duration of storage:
Your personal information will be stored for as long as necessary to fulfill the purposes described in this Privacy Policy or as required by law, e.g. for tax and accounting purposes.
Right of cancellation and removal:
You have the right to revoke your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. You can prevent the collection and processing of your personal data by Google by preventing the storage of third-party cookies on your computer.
For Applicants
1. Processing of Your Personal Data
KTG GmbH collects the following personal data from you as part of the application process:
- First name and surname
- E-mail address
- Telephone / mobile phone number
- Availability
- Salary expectations
- All personal data contained in the application (CV, cover letter, references, etc.)
KTG collects personal data from applicants as follows:
- Direct application via the KTG career pages
- Application by e-mail addressed directly to a KTG employee
- Postal application
- Immediate applications made via application platforms
- Recruitment agency
- Candidates who are contacted by KTG via social media platforms (e.g. Xing, LinkedIn)
2. Purposes of the Processing and Its Legal Basis
Your personal data will be processed for the following purposes:
- Implementation of the application procedure and decision on the establishment of the employment relationship
- Communication (telephone, e-mail, video telephony)
- Implementation of pre-contractual measures (initiation of the employment relationship)
- Inclusion of applicant data in an applicant pool
- Assertion, exercise, or defense of legal claims arising from the application process
Processing of special categories of personal data that have been made public:
Insofar as special categories of personal data are processed that you have obviously made public, your data will be processed in accordance with Art. 9 para. 2 lit. e GDPR.
Processing for the establishment, exercise, or defense of legal claims or in the event of legal proceedings:
If necessary, your data will be processed for the purpose of asserting, exercising, or defending legal claims or in the case of actions by the courts pursuant to
Art. 6 para. 1 sentence 1 lit. f GDPR, Art. 9 para. 1 lit. f GDPR.
Processing on the basis of consent:
If you have given your consent to data processing, your data will be processed in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR in conjunction with Art. 7 GDPR, Art. 88 para. 1 GDPR (in conjunction with Art. 26 para. 2 BDSG, applies in Germany).
Processing for the purpose of performing the contract with you:
Insofar as we process your personal data for the purpose of contract fulfillment, Art. 6 para. 1 sentence 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary for the implementation of pre- and post-contractual measures.
Processing for the fulfillment of a legal obligation:
Insofar as the processing of your personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 para. 1 sentence 1 lit. c GDPR serves as the legal basis. Our legal obligation to process data arises, for example, from retention obligations under tax and/or commercial law.
Decision on the establishment of the employment relationship:
We process your data in order to make a decision on the establishment of the employment relationship. If you are hired by our company, your data will be processed for the purpose of implementing and terminating the employment relationship. Separate information about the processing of your personal data will be provided for this purpose.
Processing on the basis of legitimate interest:
Insofar as the processing is carried out to safeguard a legitimate interest of us or a third party and your interests or fundamental rights and freedoms do not outweigh the first-mentioned interest, Art. 6 para. 1 sentence 1 lit. f GDPR serves as the legal basis for data processing. Our legitimate interest arises in particular for the following reasons:
- The proper implementation and optimization of the application process
- Assertion, exercise, or defense of legal claims
Processing of special categories of personal data:
If you have given your consent to the processing of special categories of personal data, such as health data, religious affiliation, or nationality, your data will be processed in accordance with Art. 9 para. 2 lit. a GDPR.
3. Recipients or Categories of Recipients of the Personal Data and Third Country Transfers
As part of the processing of your personal data, we may pass on your personal data to the following recipients:
- Internally, only authorized employees are granted access to an applicant’s data via an authorization concept.
- To a system house commissioned by us to operate an online application platform as part of order processing:
rexx systems GmbH,
Süderstrasse 75-79, 20097 Hamburg - As part of a sanctions list comparison to a service provider commissioned by us in order to avert possible damages or penalties (including EC Regulation 2580/2001, EU Regulation 881/2002, EU Regulation 753/2011) from our company:
Siemssen Consulting GmbH,
Stresemannstraße 46, 27570 Bremerhaven, Germany - In connection with cooperation in HR/applicant management with affiliated companies:
RAILPOOL GmbH,
Seidlstraße 23, 80335 Munich
Railpool Lokservice GmbH & Co. KG,
Grusonstraße 46, 22113 Hamburg
Tankweg, 21129 Hamburg
NTT AS,
Kværnerveien 6, 0195 Oslo
Railpool GmbH Branch Italia,
Piazza Sandro Pertini 4/4, 17100 Savona
Railpool Polska Sp. z o.o.,
Ul. Górecka 1, 60-201 Poznań
Railpool France SAS,
15 rue Traversière, 75012 Paris
For communication with applicants, we use the Microsoft 365 service, including Microsoft Teams, from the service provider Microsoft Operations Ltd. in Dublin, Ireland. Further information on data processing by Microsoft can be found at: https://privacy.microsoft.com/de-de/privacystatement
4. Duration of Storage
We will delete your personal data as soon as the purposes of the processing and the legal basis for its storage no longer apply, or you object to the use of your personal data (in the case of processing on the basis of legitimate interests) or you withdraw your previously granted consent. However, your personal data may also be stored beyond this, in particular in the following cases:
- If contractual, legal, or statutory retention periods prevent deletion
- For the assertion, exercise, or defense of legal claims
- If this is necessary under European or national law to fulfill a legal obligation to which we are subject.
The following retention periods, in particular, result for us from statutory provisions:
- After decision on non-appointment: 180-day retention period for application documents.
If the applicant has consented, the application documents will be included in an applicant pool and stored there for a maximum of 1 year from the date of consent. They will be deleted when the purpose no longer applies or when the applicant withdraws their consent.
In the event of recruitment, your personal data will be deleted when the purpose no longer applies, at the latest after termination of the employment relationship, provided that there are no statutory retention periods to prevent deletion.
For Customers, Suppliers, Service Providers, and Interested Parties
1. Processing of Your Personal Data
1.1 Your Personal Data That Is Processed by Us
We process personal data of customers, suppliers, service providers, and interested parties. This is necessary for business operations. The following data is processed: We process the following personal data for the initiation of a contract:
- Salutation
- First name
- Surname
- Titles and academic degrees
- Position in the company
- Company name
- Business address
- Bank details
- Tax ID
- Customer number
- Your e-mail address
- Your mobile phone number
- Your landline number
- Your fax number
- All personal data provided to us in the course of communication
- Creditworthiness data
We collect data from interested persons and customers in the following ways:
- Enquiries via the contact form on the KTG website
- Enquiries by message to KTG employees, e.g. by e-mail or other communication channels
- Enquiries at trade fairs or other events where data is passed on to KTG employees with the aim of establishing contact
- Own research on potential interested parties in business directories, contact details on websites, or professional networks
- Independent booking of an appointment by an interested person
- Requesting personal data from the person themselves or receiving personal data from an employee of the customer company after concluding a contract with KTG. This may also concern employees of service providers of the customer company
1.2 Purposes of Data Processing
Your personal data will be processed for the following purposes as part of the existing customer relationship and contract initiation:
- To process your enquiry as an interested party
- To prepare and implement pre-contractual measures
- To add your contact details to our customer and contact database
- Contact (e-mail, telephone)
- Initiation, implementation, and termination of a contractual relationship
- Customer administration and customer care
- To provide you, our customer, with the best possible service. This includes in particular communicating with you by e-mail, mobile phone, landline, or fax
- To ensure smooth invoicing of the services provided. For this purpose, your personal data is processed in order to be able to issue invoices
- To fulfil our legal obligations. This includes, for example, the transfer of your personal data to the tax office
- For the purpose of carrying out marketing initiatives such as: Invitations to events
- For the fulfilment of post-contractual measures
- For the assertion, exercise, or defense of legal claims
- To find out how satisfied you are with our products and services
- Measures for business management and further development of our products
1.3 Legal Basis for Data Processing
Processing of your personal data on the basis of consent:
Insofar as we obtain your consent for the processing of your personal data, the processing of your personal data is carried out on the basis of Art. 6 para. 1 sentence 1 lit. a GDPR in conjunction with Art. 5, 7 GDPR.
Processing for the purpose of performing the contract with you:
Insofar as we process your personal data for the purpose of contract fulfilment, Art. 6 para. 1 sentence 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary for the implementation of pre- and post-contractual measures.
Processing for the fulfilment of a legal obligation:
Insofar as the processing of your personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 para. 1 sentence 1 lit. c GDPR serves as the legal basis. Our legal obligation to process data arises, for example, from retention obligations under tax and/or commercial law.
Processing on the basis of legitimate interest:
The legal basis for the purpose of direct advertising may be Art. 6 para. 1 sentence 1 lit. f GDPR if our legitimate interests exist unless the interests or fundamental rights and freedoms of the data subject which require the protection of personal data prevail. The legitimate interests pursued by us in this regard – in addition to the purposes listed under 1.2 – include:
- To provide you with the best possible information about our products, offers, and services by means of direct marketing
- In order to be able to carry out due diligence with our potential business partner
- In order to be able to carry out a sanctions list comparison with a contracted service provider in order to avert possible damages or penalties (including EC Regulation 2580/2001, EU Regulation 881/2002, EU Regulation 753/2011) from our company:
Siemssen Consulting GmbH,
Stresemannstraße 46, 27570 Bremerhaven - To obtain customer feedback to improve the customer experience, improve our products and services
The legal basis for processing activities in connection with the assertion, exercise, or defense of legal claims is also our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR.
2. Recipients or Categories of Recipients of the Personal Data and Third Country Transfers
As part of the processing of your personal data, we may pass on your personal data to the following recipients. We only transfer your personal data to external recipients if you have given your consent or if this is permitted by law.
External recipients of your personal data are in particular:
- Freelancer
- Order data processor
- Authorities, e.g. tax offices, courts, trade supervisory office, data protection supervisory authorities, Federal Office of Economics and Export Control (BAFA)
- Billing partner
- Credit institutions
- Post & parcel service provider
- Lawyer, tax consultant
- Auditor
- Associated companies
Your personal data will be transmitted to the following service providers:
- Microsoft Operations Ltd. in Dublin, Ireland
- SugarCRM Inc., San Francisco, CA
- DocuSign Inc., San Francisco, USA
3. Duration of the Storage of Personal Data
We do not store your personal data for longer than is necessary for the purpose for which it was collected. This means that data is destroyed or deleted from our systems as soon as it is no longer required. We take appropriate measures to ensure that your personal data is only processed under the following conditions:
- For the duration that the data is used to provide you with a service
- As required by applicable law, a contract, or with respect to our legal obligations
- Only for as long as necessary for the purpose for which the data was collected or longer if required by contract, applicable law, using appropriate safeguards.
A requirement may exist in particular if the data is still needed to fulfill contractual services, to check and grant or defend against warranty and guarantee claims. If the data is no longer required for the fulfillment of contractual or legal obligations, it is regularly deleted unless its – temporary – retention is still necessary, in particular to fulfill legal retention periods of up to ten years (e.g. from the German Commercial Code or the German Fiscal Code). In the case of statutory retention obligations, deletion will only be considered after expiry of the respective retention obligation.
4. Obligation to Provide the Data
For the (planned) conclusion and execution of a contract with you, you must provide the personal data that is necessary for the establishment and execution of the contractual relationship and the fulfillment of the associated contractual obligations or that we are legally obliged to collect. Without this data, we will generally not be able to conclude and fulfill the contract with you.
